cPanel prior to 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).
cpanel cpanel